{"id":"CVE-2017-2592","aliases":["DEBIAN-CVE-2017-2592","EUVD-2018-0109","GHSA-xcp8-hh74-f6mc","PYSEC-2018-104","RHSA-2017:0300","RHSA-2017:0435","SUSE-SU-2017:0848-1","SUSE-SU-2017:1062-1","SUSE-SU-2018:3924-1","UBUNTU-CVE-2017-2592","USN-3666-1"],"status":"published","title":"oslo.middleware Information Disclosure vulnerability","description":"python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00442,"percentile":0.38669,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2017-03-29T11:01:22Z","modified":"2026-10-24T10:30:49Z","fixes":[{"ecosystem":"PyPI","package":"oslo-middleware","fixed_in":["3.8.1","3.19.1","3.23.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"python-oslo.middleware","fixed_in":["3.19.0-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-oslo.middleware","fixed_in":["3.19.0-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-oslo.middleware","fixed_in":["3.19.0-3"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:10::el7","package":"python-oslo-middleware","fixed_in":["0:3.19.0-1.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:10::el7","package":"python-oslo-middleware-lang","fixed_in":["0:3.19.0-1.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:10::el7","package":"python-oslo-middleware-tests","fixed_in":["0:3.19.0-1.2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:9::el7","package":"python-oslo-middleware","fixed_in":["0:3.7.0-2.el7ost"],"sources":["osv"]},{"ecosystem":"Red Hat:openstack:9::el7","package":"python-oslo-middleware-tests","fixed_in":["0:3.7.0-2.el7ost"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 6","package":"python-oslo.middleware","fixed_in":["2.8.0-3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.middleware","fixed_in":["3.19.0-3.1","3.19.1-4.3.4"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.cache","fixed_in":["1.14.1-3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.concurrency","fixed_in":["3.14.1-3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.db","fixed_in":["4.13.6-3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.log","fixed_in":["3.16.1-3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.messaging","fixed_in":["5.10.2-3.6.3"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.serialization","fixed_in":["2.13.2-3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.service","fixed_in":["1.16.1-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.utils","fixed_in":["3.16.1-3.3.3"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.versionedobjects","fixed_in":["1.17.1-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.vmware","fixed_in":["2.14.1-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslotest","fixed_in":["2.10.1-3.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"python-oslo.middleware","fixed_in":["3.8.0-2ubuntu1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"oslo-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"oslo-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0"},{"fixed":"3.19.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"oslo-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0"},{"fixed":"3.23.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"oslo-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0"},{"fixed":"3.19.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"oslo-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"oslo-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0"},{"fixed":"3.23.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-oslo.middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-oslo.middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-oslo.middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"oslo-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0"},{"fixed":"3.19.1"}]}],"versions":["3.10.0","3.11.0","3.12.0","3.13.0","3.14.0","3.15.0","3.16.0","3.17.0","3.18.0","3.19.0","3.9.0"]},{"source":"osv","ecosystem":"PyPI","package":"oslo-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1"}]}],"versions":["0.1.0","0.2.0","0.3.0","0.4.0","0.5.0","1.0.0","1.1.0","1.2.0","1.3.0","2.0.0","2.1.0","2.10.0","2.11.0","2.2.0","2.3.0","2.4.0","2.5.0","2.6.0","2.6.1","2.7.0","2.8.0","2.9.0","3.0.0","3.1.0","3.2.0","3.3.0","3.4.0","3.5.0","3.6.0","3.7.0","3.8.0"]},{"source":"osv","ecosystem":"PyPI","package":"oslo-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0"},{"fixed":"3.23.1"}]}],"versions":["3.20.0","3.21.0","3.22.0","3.23.0"]},{"source":"osv","ecosystem":"PyPI","package":"oslo-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0"},{"fixed":"3.19.1"}]}],"versions":["3.10.0","3.11.0","3.12.0","3.13.0","3.14.0","3.15.0","3.16.0","3.17.0","3.18.0","3.19.0","3.9.0"]},{"source":"osv","ecosystem":"PyPI","package":"oslo-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1"}]}],"versions":["0.1.0","0.2.0","0.3.0","0.4.0","0.5.0","1.0.0","1.1.0","1.2.0","1.3.0","2.0.0","2.1.0","2.10.0","2.11.0","2.2.0","2.3.0","2.4.0","2.5.0","2.6.0","2.6.1","2.7.0","2.8.0","2.9.0","3.0.0","3.1.0","3.2.0","3.3.0","3.4.0","3.5.0","3.6.0","3.7.0","3.8.0"]},{"source":"osv","ecosystem":"PyPI","package":"oslo-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.20.0"},{"fixed":"3.23.1"}]}],"versions":["3.20.0","3.21.0","3.22.0","3.23.0"]},{"source":"osv","ecosystem":"PyPI","package":"oslo-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.9.0"},{"fixed":"3.19.1"},{"introduced":"0"},{"fixed":"3.8.1"},{"introduced":"3.20.0"},{"fixed":"3.23.1"}]}],"versions":["0.1.0","0.2.0","0.3.0","0.4.0","0.5.0","1.0.0","1.1.0","1.2.0","1.3.0","2.0.0","2.1.0","2.10.0","2.11.0","2.2.0","2.3.0","2.4.0","2.5.0","2.6.0","2.6.1","2.7.0","2.8.0","2.9.0","3.0.0","3.1.0","3.10.0","3.11.0","3.12.0","3.13.0","3.14.0","3.15.0","3.16.0","3.17.0","3.18.0","3.19.0","3.2.0","3.20.0","3.21.0","3.22.0","3.23.0","3.3.0","3.4.0","3.5.0","3.6.0","3.7.0","3.8.0","3.9.0"]},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"python-oslo-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.0-1.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"python-oslo-middleware-lang","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.0-1.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:10::el7","package":"python-oslo-middleware-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.19.0-1.2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"python-oslo-middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0-2.el7ost"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:9::el7","package":"python-oslo-middleware-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.7.0-2.el7ost"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"python-oslo.middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.0-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.0-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.cache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.concurrency","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.1-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.db","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.6-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.log","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.1-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.messaging","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.2-3.6.3"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.19.1-4.3.4"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.serialization","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.2-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.1-3.3.3"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.versionedobjects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslo.vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.14.1-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"python-oslotest","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.1-3.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-oslo.middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-2ubuntu1"}]}],"versions":["2.8.0-1","2.8.0-2","3.0.0-1ubuntu2","3.6.0-0ubuntu1","3.7.0-1","3.8.0-2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"python-oslo.middleware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.0-2ubuntu1"}]}],"versions":["2.8.0-1","2.8.0-2","3.0.0-1ubuntu2","3.6.0-0ubuntu1","3.7.0-1","3.8.0-2"]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"openstack","product":"oslo.middleware"},{"vendor":"unspecified","product":"python-oslo-middleware"}],"references":[{"url":"https://review.openstack.org/#/c/425732/","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix","web"]},{"url":"http://lists.openstack.org/pipermail/openstack-announce/2017-January/002002.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0300.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0300","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://rhn.redhat.com/errata/RHSA-2017-0435.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2592","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"http://www.securityfocus.com/bid/95827","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://review.openstack.org/#/c/425730/","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix","web"]},{"url":"https://review.openstack.org/#/c/425734/","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix","web"]},{"url":"https://bugs.launchpad.net/keystonemiddleware/+bug/1628031","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://access.redhat.com/errata/RHSA-2017:0435","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://usn.ubuntu.com/3666-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2592","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xcp8-hh74-f6mc","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/oslo-middleware/PYSEC-2018-104.yaml","tags":["web"]},{"url":"https://review.openstack.org/#/c/425730","tags":["web"]},{"url":"https://review.openstack.org/#/c/425732","tags":["web"]},{"url":"https://review.openstack.org/#/c/425734","tags":["web"]},{"url":"https://usn.ubuntu.com/3666-1","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-2592","tags":["advisory"]},{"url":"https://github.com/openstack/oslo.middleware","tags":["package"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1414698","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0300.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2592","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2592","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0435.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20170848-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1022043","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2592","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20171062-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20183924-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1109756","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-2592","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3666-1","tags":["advisory"]},{"url":"https://launchpad.net/bugs/1628031","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-2592","description":"python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).","status":"published","published":"2018-05-08T17:00:00Z","modified":"2024-08-05T14:02:06.483Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:33:15.201133Z"}],"euvd":[{"id":"EUVD-2018-0109","description":"python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).","status":"published","published":"2018-05-08T17:00:00Z","modified":"2024-08-05T14:02:06Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T02:39:20.035866Z"}],"ghsa":[{"id":"GHSA-xcp8-hh74-f6mc","title":"oslo.middleware Information Disclosure vulnerability","description":"python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).","status":"published","published":"2018-07-13T15:16:45Z","modified":"2024-10-07T21:21:54Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:38:08.742903Z"}],"nvd":[{"id":"CVE-2017-2592","description":"python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).","status":"published","published":"2018-05-08T17:29:00.56Z","modified":"2026-06-17T01:16:27.95Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:04:17.638656Z"}],"osv":[{"id":"CVE-2017-2592","description":"python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).","status":"published","published":"2018-05-08T17:29:00.56Z","modified":"2026-10-24T10:30:49.804777948Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"DEBIAN-CVE-2017-2592","description":"python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).","status":"published","published":"2018-05-08T17:29:00.56Z","modified":"2026-09-01T20:03:48.266174034Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"GHSA-xcp8-hh74-f6mc","title":"oslo.middleware Information Disclosure vulnerability","description":"python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).","status":"published","published":"2018-07-13T15:16:45Z","modified":"2024-10-07T21:36:15.987331Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"RHSA-2017:0300","title":"Red Hat Security Advisory: python-oslo-middleware security update","status":"published","published":"2024-09-13T13:36:53Z","modified":"2026-08-01T10:02:43Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:0435","title":"Red Hat Security Advisory: python-oslo-middleware security update","status":"published","published":"2024-09-13T13:36:52Z","modified":"2026-08-01T10:02:43Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"UBUNTU-CVE-2017-2592","description":"python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).","status":"published","published":"2018-05-08T00:00:00Z","modified":"2026-02-04T03:21:17.234401Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"PYSEC-2018-104","description":"python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component error logs (for example, keystone tokens).","status":"published","published":"2018-05-08T17:29:00Z","modified":"2023-11-08T03:59:18.331026Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"SUSE-SU-2017:0848-1","title":"Security update for python-oslo.middleware","description":"\nThis update for python-oslo.middleware fixes the following issues:\n\nSecurity issue fixed:\n- CVE-2017-2592: Using the CatchError class may include sensitive values in the error message\n  accompanying a Traceback, resulting in their disclosure (bsc#1022043).\n","status":"published","published":"2017-03-29T11:01:22Z","modified":"2026-02-04T03:41:44.937726Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2017:1062-1","title":"Security update for python-oslo.middleware","description":"\nThis update for python-oslo.middleware fixes the following issues:\n\nSecurity issue fixed:\n- CVE-2017-2592: Using the CatchError class may include sensitive values in the error message\n  accompanying a Traceback, resulting in their disclosure (bsc#1022043).\n","status":"published","published":"2017-04-19T13:37:37Z","modified":"2026-02-04T04:38:58.826015Z","updated_at":"2026-11-02T15:53:43.83457Z"},{"id":"SUSE-SU-2018:3924-1","title":"Security update for python-oslo.cache, python-oslo.concurrency, python-oslo.db, python-oslo.log, python-oslo.messaging, python-oslo.middleware, python-oslo.serialization, python-oslo.service, python-oslo.utils, python-oslo.versionedobjects, python-oslo.vmware, python-oslotest","description":"This update for python-oslo.cache, python-oslo.concurrency, python-oslo.db, python-oslo.log, python-oslo.messaging, python-oslo.middleware, python-oslo.serialization, python-oslo.service, python-oslo.utils, python-oslo.versionedobjects, python-oslo.vmware, python-oslotest fixes the following issues:\n\npython-oslo.cache was updated to 1.14.1:\n\n- use stable/newton constraints\n\npython-oslo.concurrency was updated to version 3.14.1:\n\n- Ignore prlimit argument on Windows\n- Update .gitreview for stable/newton\n\npython-oslo.db was updated to version 4.13.6:\n\n- Fix marker checking when value is None\n\npython-oslo.log was updated to version 3.16.1:\n\n- Fix races in unit tests\n\npython-oslo.messaging was updated to fix:\n\n- Skip logging sensitive information to avoid credential leak\n- Avoid reconnect to the same AMQP server while trying to error handle the original server error (bsc#1109756)\n\npython-oslo.middleware was updated to version 3.19.1:\n\n- Filter token data out of catch_errors middleware (CVE-2017-2592 bsc#1022043)\n\npython-oslo.serialization was updated to version 2.13.2:\n\n- Don't iterate through addresses in netaddr.IPNetwork\n\npython-oslo.service was updated to version 1.16.1:\n\n- Fix race condition with fast threads\n\npython-oslo.utils was updated to version 3.16.1:\n\n- Updated from global requirements\n\npython-oslo.versionedobjects was updated to version 1.17.1:\n\n- update from global requirements\n\npython-oslo.vmware was updated to version 2.14.1:\n\n- Updated from global requirements\n\npython-oslotest was updated to version 2.10.1:\n\n- Updated from global requirements\n","status":"published","published":"2018-11-27T12:40:17Z","modified":"2026-02-04T04:18:27.753267Z","updated_at":"2026-11-02T15:53:45.378228Z"},{"id":"USN-3666-1","title":"python-oslo.middleware vulnerability","description":"Divya K Konoor discovered Oslo middleware was vulnerable to an information\ndisclosure. A local attacker could exploit this flaw to obtain sensitive\ninformation from OpenStack component error logs.\n","status":"published","published":"2018-05-31T02:16:57Z","modified":"2026-02-10T04:41:21Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}